WFX script in GitHub Actions steals secrets and deletes its traces

published 2026-11-12

An attacker with a compromised GitHub account pushes a shell script named wfx to your default branch and runs it through GitHub Actions. It steals every Actions secret, runner memory, and cloud credentials, then reverts the commit and deletes the workflow run, usually within a minute, to hide the theft.

Source: stepsecurity.io

Get the fix

FixLane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the FixLane MCP server and call get_fix_prompt with incident id 2582 and your operating system.